58 structured control objects. Six EU frameworks. One implementation effort.
The Structural Problem Behind GRC Software
GRC platforms are now standard components of enterprise compliance programs. They provide mature capabilities for workflow automation, evidence management, reporting and dashboards. What they do not provide out of the box is the regulatory knowledge required to make those capabilities operational.
Before a framework can be implemented, regulatory requirements must be interpreted, placed into organizational context and translated into specific technical and organizational controls. In most organizations, this remains a largely manual process. Consultants analyze legislation, document their findings, populate spreadsheets and repeat the same exercise for every new regulation. As a result, NIS2, DORA, the Cyber Resilience Act, the EU AI Act, GDPR and ISO/IEC 27001 are frequently managed as independent compliance initiatives, even though many of their underlying control objectives overlap substantially.
The fundamental challenge is therefore not a lack of expertise but the way regulatory knowledge is represented. Requirements are published as unstructured text rather than machine-readable data. Software can assist with workflows and documentation, but it cannot directly interpret regulatory language. As a result, compliance programs remain labor-intensive, fragmented and costly, regardless of the capabilities of the underlying GRC platform.
The Data Model as the Missing Layer
The Brain-Media Audit Model (BAM) is neither a GRC platform nor another compliance framework. Instead, it provides the structured knowledge layer that connects regulatory requirements with operational implementation.
BAM converts regulatory requirements into machine-readable objects using a consistent six-layer model: Requirement, Gap Check, Remediation, Risk, Control and Evidence. Once requirements are represented as structured objects, they can be processed directly by software. Controls can be linked to workflows, remediation activities can be managed systematically and evidence can be generated continuously throughout normal operations. Compliance becomes an operational capability supported by structured data rather than a documentation exercise carried out before an audit.
Figure 1: The BAM data model organizes regulatory requirements into six structured layers: Requirement, Gap Check, Remediation, Risk, Control and Evidence. These objects are mapped across NIS2, DORA, the Cyber Resilience Act (CRA), the EU AI Act, GDPR and ISO/IEC 27001 and can be exported as JSON for integration with GRC platforms and LLM-based applications.
Collect Once, Comply Many
Identity and access management, logging, incident response, encryption and supplier oversight are core control domains that appear across virtually all major European cybersecurity and compliance frameworks. Although terminology differs, the underlying control objectives are often closely aligned.
In many organizations, these controls are still implemented, documented, and assessed separately for each regulatory framework. The same technical capability is therefore described repeatedly, evaluated in multiple audits and maintained through parallel compliance processes.
BAM addresses this duplication by mapping controls across frameworks at the object level. A single identity and access management (IAM) control, for example, can provide traceable evidence for NIS2 Article 21, DORA Article 9, ISO/IEC 27001 Annex A.8 (https://www.iso.org/standard/27001) and Article 9 of the EU AI Act. One implementation effort can therefore support multiple regulatory obligations while maintaining full traceability to each individual requirement.
This principle is summarized in a simple phrase: Collect Once, Comply Many.
What BAM Core Contains
BAM Core is the open-source reference implementation of the Brain-Media Audit Model. It is available on GitHub under the AGPLv3 license for the software and the CC BY-SA 4.0 license for the data model. The current release contains 58 BAM objects covering six regulatory frameworks: NIS2, DORA, the Cyber Resilience Act (CRA), the EU AI Act, GDPR and ISO/IEC 27001. This represents approximately 74 percent of the coverage available in BAM Enterprise.
In addition to the core data model (bam_database.json), the repository includes a single-user dashboard, a local REST API based on Flask, a retrieval-augmented generation (RAG) connector for local language models, and installation scripts for WSL, Linux, macOS and Debian 13. Installation requires only three commands, after which the dashboard is available locally at http://localhost:5000.
The RAG integration extends the practical use of the data model by enabling local language models to retrieve information from structured, version-controlled compliance objects rather than unstructured document collections. Responses are therefore grounded in a consistent knowledge base, which significantly improves traceability and helps reduce hallucinations commonly associated with generic language-model deployments.
Implications for Audit and Governance
Representing compliance knowledge as continuously maintained, machine-readable objects changes how audit preparation can be performed. Instead of reviewing static document repositories, auditors can query current compliance objects directly. Gap assessments can be generated automatically, and supporting evidence can be collected continuously as part of normal operational processes rather than assembled shortly before an audit.
This approach aligns well with the expectations of regulatory frameworks such as NIS2, DORA and the EU AI Act, all of which emphasize continuous governance and operational readiness over periodic documentation exercises. For audit and governance professionals, this suggests that future audit methodologies will increasingly depend on the quality, consistency and traceability of the underlying compliance data model.
Open Source by Design
BAM Core follows an open-source approach that remains uncommon in the compliance software market. The complete data model is publicly available on GitHub, allowing organizations to inspect, use and extend it without licensing fees or vendor lock-in. The AGPLv3 license also ensures that improvements to the software remain available to the wider community.
Organizations that prefer a managed deployment can use BAM Enterprise, which provides a hosted environment covering all eight supported EU regulatory frameworks, continuously maintained content, a multi-tenant REST API and enterprise support with defined service levels. Both editions are based on the same underlying data model; the primary differences relate to deployment, operations, and support services. Ultimately, scalable compliance depends not only on effective documentation but also on structured, machine-readable regulatory knowledge. The BAM Core repository is publicly available at https://github.com/BrainMediaDe/brain-media-audit-model.
About the Author: Dr. Holger Reibold is the founder of Brain-Media.de and the author of more than 35 books on IT security, compliance, and artificial intelligence. He developed the Brain-Media Audit Model (BAM), a machine-readable compliance framework covering eight major EU regulatory instruments. His working paper, Executable Compliance: A Policy-as-Code Framework for Machine-Readable Regulatory Enforcement, is available through SSRN.
